Start here: an NFT showed up. What now?
Most people land on this page after seeing a token they did not buy. Use this table before reading further. It says what to do first, and what not to do.
| Situation | Likely meaning | First move |
|---|---|---|
| It appeared with no prior activity on your side and the name says “claim”, “reward” or shows a URL | Bait. The image or name carries a link. | Do not visit the link. Hide the item in your wallet or marketplace. |
| You used a protocol and its official page announces an NFT for users | Possibly a real reward. | Confirm on the project’s own site or docs, reached from a link you typed or bookmarked. |
| It appeared in many wallets at once, same artwork | Mass distribution, commonly spam. | Leave it. Do not list, transfer or burn it to “test”. |
| A site asks you to approve or sign to “verify” or “claim” | Possible drainer. | Reject the request. If you already signed, move to revoking approvals now. |
How NFT airdrops work
An NFT airdrop is a transfer of one or more non-fungible tokens to a list of addresses. There are three common delivery patterns, and knowing which one you are looking at tells you most of what you need.
- Push. The sender mints or transfers tokens directly to your address. You do nothing. This is how unsolicited NFTs arrive, and it is also how some genuine community rewards arrive.
- Claim. You visit an official page, connect a wallet, and sign a claim transaction. A genuine claim should be linked from the project’s own site and should ask only for a claim, not for broad approvals.
- Allowlist mint. Your address is on a list and you mint for free, or for a fee, within a window. You pay network fees either way.
Because the sender chooses the recipient list, the token appearing in your wallet says nothing about you. Anyone can send anything to any address. That is the root of the spam problem, and it is also why a genuine project will never use an unannounced push as its only way to tell you about a reward. For the general idea of airdrops, see what a crypto airdrop is.
Signs of a genuine NFT reward
- Announced on the project’s own site or documentation before it arrived
- Tied to an action you took, such as using the product
- Claim page reached from an official link, not from the token itself
- Asks for a claim signature only
Signs of bait
- No prior activity, no announcement
- Name or image contains a URL or “visit to claim”
- Same token in many unrelated wallets
- Pressure: countdown, “limited”, “verify now”
The standards behind NFTs
You will see these names in wallets and explorers. They describe how a token behaves, and they matter for safety because approval functions are part of them.
| Standard | Chain | What its official documentation says |
|---|---|---|
| ERC-721 | Ethereum and compatible chains | The ethereum.org page describes it as the standard for non-fungible tokens, where each token is distinct. Each has a tokenId, and the contract address plus ID must be unique. It includes approve for one token and setApprovalForAll for all tokens an owner holds in that contract. |
| ERC-1155 | Ethereum and compatible chains | One contract can manage a mix of fungible, non-fungible and semi-fungible tokens, with batch transfers. Approval uses setApprovalForAll and is all-or-nothing: you cannot cap an amount or limit it to specific token types. |
| Metaplex Token Metadata | Solana | An NFT is a mint account with supply of one, zero decimals and no mint authority, plus a metadata account that holds a name, creators and a URI pointing to an off-chain JSON file. Metaplex labels this program as legacy: still supported, not recommended for new projects. |
| Metaplex Core | Solana | A newer standard that the Metaplex pages recommend for new projects. Each asset is a single account holding ownership, a metadata URI and plugin data. Plugins can run at lifecycle events such as create, transfer and burn. |
Two safety implications follow. On Ethereum-style chains, setApprovalForAll is the permission a malicious site wants, because one signature gives an operator power over every token you hold in that contract. On Solana, the metadata URI is an off-chain pointer, so whatever name, image or text a marketplace shows is data supplied by the token’s creator. It is not verified by the chain. We cover how to undo broad permissions in revoke token approvals.
We did not find an official Metaplex statement about compressed NFTs on the pages we opened, so this guide does not describe them.
How to find real NFT airdrops
Genuine NFT rewards are announced before they arrive. Our editorial approach is to start from the project, never from the token. The steps below are the order we use.
- Check the project’s documentation or official blog for a reward announcement. Reach it from a bookmark or from our latest verified campaigns, not from a link inside the NFT.
- Match the contract address on the announcement with the one in your wallet. If the project does not publish an address, treat that as unresolved.
- Compare the action you took with the stated criteria. If you cannot connect your activity to the criteria, be sceptical.
- Use the claim site only if its address matches the one in the official documentation. See how to judge whether an airdrop is legitimate for the longer test.
For ecosystem-specific lists, our Ethereum and Solana pages track campaigns we have checked. Our verification method explains what “checked” means.
Scam patterns around unsolicited NFTs
The claim-site lure
The NFT’s name or image tells you to visit a site. OpenSea’s own write-up says scammers send unwanted NFTs whose listings carry links to malicious third-party sites, and that people who visit and interact can be phished and lose NFTs.
The broad approval
A site asks you to sign setApprovalForAll, often described as “verify” or “list”. In the standards above, this gives an operator control over all tokens you hold in that contract.
The poisoned metadata
The token’s metadata can contain text or an external URL. Metadata is set by the token’s creator and is not verified by the chain, so treat any link or instruction inside it as untrusted.
The “test sale”
You are urged to sell or list the NFT quickly for a high offer, which requires connecting to a marketplace-lookalike site. Real marketplace offers do not need a link from a token description.
The fee for a free item
A “claim” asks you to send funds first. Genuine airdrops do not require a payment to receive them, apart from the network fee for your own claim transaction.
Honest uncertainty
We could not verify a public breakdown of how often each pattern occurs, so we do not rank them by frequency. Treat all five as live.
Safe handling of NFTs you did not ask for
-
Do not interact
No clicking on links, no transfers, no listing, no approvals. Do not paste your wallet address into a site the token mentions.
-
Hide it where you see it
Use the hide option in your wallet or marketplace profile. Many explorers and wallets also have their own spam filter. Check how yours works in its documentation.
-
Check your approvals
If you have been using a wallet with many NFT apps, review active approvals and revoke what you no longer use.
-
Separate your wallets
Use a throwaway address for claims and keep valuable assets elsewhere. See burner wallets for airdrops.
-
Report if the venue lets you
Marketplaces such as OpenSea have spam policies. Reporting helps others, but it is optional.
If you do want to try a genuine claim, our burner wallet guide describes a setup that limits what a mistake can cost you. Marketplace spam is also covered in the general airdrop scams guide.
Do free NFTs have value, and what about tax?
Some free NFTs have a market and many do not. A token with a listing is not necessarily liquid, and a floor price shown on a marketplace is not the price at which you could sell. We do not give price views.
On tax, we found no official page we could open that addresses unsolicited NFTs directly. The IRS digital assets page says that income from digital assets is taxable and that records are required. HMRC’s manual distinguishes airdrops received without doing anything in return from those given for a service. Whether either applies to a spam NFT is a question for your tax authority. What helps in any system is a record of when and how the token arrived. Our airdrop tax orientation has a template, and it is not tax advice.
Claim-safety checklist for an NFT airdrop
Work through this list before you connect a wallet to anything linked to an NFT. It saves in your browser only.
Before you claim or connect
0/8
A rule of thumb from our desk, labelled as editorial judgement: the more urgent the message around a free NFT, the less likely it is to be a reward. Real programmes tend to publish criteria, dates and a documented contract. Bait publishes a countdown.
Primary sources
Sources last checked 19 Oct 2026. Links open the project's own pages, not summaries from other sites.
- ethereum.org: ERC-721 non-fungible token standardethereum.org
- ethereum.org: ERC-1155 multi-token standardethereum.org
- Metaplex: Token Metadatametaplex.com
- Metaplex: Coremetaplex.com
- OpenSea blog: Hiding suspicious NFT transfersblog-v3.opensea.io
- IRS: Digital assetsirs.gov
Frequently asked questions
What is an NFT airdrop?
It is a distribution of non-fungible tokens to wallet addresses, usually without a purchase. Some are genuine rewards for past activity or holding another asset. Many are unsolicited transfers sent to thousands of addresses at once, and those are most often spam or scam bait. The token standard on the chain only tells you how it works, not whether it is trustworthy.
Is a free NFT in my wallet dangerous?
Receiving one is not usually the problem. OpenSea says it has not seen an instance where simply receiving a transferred NFT caused malicious activity on its own. The risk comes from visiting a link in the listing or metadata, or signing a request. If you did not expect it, do not click, connect or sign anything related to it.
Should I burn or hide a spam NFT?
Hiding is the lower-risk default. OpenSea describes a Hidden tab that works like a spam folder, and unhiding does not interact with the NFT. Burning is an on-chain transaction that you sign, so it adds a step and a possible fee. If you are unsure what a contract does, hide it and leave it alone.
What is setApprovalForAll and why does it matter?
It is a function in the ERC-721 and ERC-1155 standards that lets an operator address manage all of your tokens in that contract. Per ethereum.org, ERC-1155 approval is all-or-nothing. A malicious site that gets you to sign it can then move every NFT in the collection. You can review and revoke approvals with an approval-management tool.
Do free NFTs have value or tax consequences?
Some may have market value and many have none. Tax treatment depends on your country and facts, and we could not find official pages that address unsolicited NFTs directly. Keep the transaction hash and date of receipt, and read our tax orientation guide, which links to the IRS and HMRC pages we reviewed.